CVE-2022-0391
📋 TL;DR
This vulnerability in Python's urllib.parse module allows injection attacks via crafted URLs containing carriage return (\r) or line feed (\n) characters in the path component. Attackers can exploit this to manipulate URL parsing outcomes, potentially leading to various injection scenarios. This affects Python applications using urllib.parse for URL handling in vulnerable versions.
💻 Affected Systems
- Python
- Applications using Python's urllib.parse module
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Hci by Netapp
Management Services For Element Software by Netapp
View all CVEs affecting Management Services For Element Software →
Ontap Select Deploy Administration Utility by Netapp
View all CVEs affecting Ontap Select Deploy Administration Utility →
Python by Python
Python is a high-level, interpreted programming language known for its readability and versatility. It is widely used in web development, data science, automation, and scientific computing.
Learn more about Python →Python by Python
Python is a high-level, interpreted programming language known for its readability and versatility. It is widely used in web development, data science, automation, and scientific computing.
Learn more about Python →Python by Python
Python is a high-level, interpreted programming language known for its readability and versatility. It is widely used in web development, data science, automation, and scientific computing.
Learn more about Python →Python by Python
Python is a high-level, interpreted programming language known for its readability and versatility. It is widely used in web development, data science, automation, and scientific computing.
Learn more about Python →Python by Python
Python is a high-level, interpreted programming language known for its readability and versatility. It is widely used in web development, data science, automation, and scientific computing.
Learn more about Python →Python by Python
Python is a high-level, interpreted programming language known for its readability and versatility. It is widely used in web development, data science, automation, and scientific computing.
Learn more about Python →Python by Python
Python is a high-level, interpreted programming language known for its readability and versatility. It is widely used in web development, data science, automation, and scientific computing.
Learn more about Python →Python by Python
Python is a high-level, interpreted programming language known for its readability and versatility. It is widely used in web development, data science, automation, and scientific computing.
Learn more about Python →Python by Python
Python is a high-level, interpreted programming language known for its readability and versatility. It is widely used in web development, data science, automation, and scientific computing.
Learn more about Python →Python by Python
Python is a high-level, interpreted programming language known for its readability and versatility. It is widely used in web development, data science, automation, and scientific computing.
Learn more about Python →⚠️ Risk & Real-World Impact
Worst Case
CRLF injection leading to HTTP response splitting, cache poisoning, or injection of malicious headers that could enable cross-site scripting (XSS), session hijacking, or server-side request forgery (SSRF).
Likely Case
CRLF injection enabling HTTP response splitting or header injection in web applications that process user-supplied URLs, potentially leading to cache poisoning or limited XSS.
If Mitigated
Limited impact if input validation and output encoding are properly implemented, though the vulnerability still exists at the parsing layer.
🎯 Exploit Status
Proof-of-concept code is available in the Python bug tracker. Exploitation requires user-controlled input being passed to vulnerable functions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Python 3.10.0b1, 3.9.5, 3.8.11, 3.7.11, 3.6.14 or later
Vendor Advisory: https://bugs.python.org/issue43882
Restart Required: Yes
Instructions:
1. Identify Python version with 'python --version'. 2. Update Python using package manager: 'apt update && apt upgrade python3' (Debian/Ubuntu) or 'yum update python3' (RHEL/CentOS). 3. Restart affected applications/services. 4. For compiled applications, recompile with patched Python.
🔧 Temporary Workarounds
Input validation for URLs
allSanitize user-supplied URLs before passing to urllib.parse by removing or rejecting CR/LF characters
import re
sanitized_url = re.sub(r'[\r\n]', '', user_input_url)
Use alternative parsing
allReplace urllib.parse.urlparse() with custom validation or alternative libraries that handle CR/LF properly
🧯 If You Can't Patch
- Implement strict input validation to reject URLs containing CR (\r) or LF (\n) characters
- Use web application firewalls (WAF) with CRLF injection rules to block malicious requests
🔍 How to Verify
Check if Vulnerable:
Test with: python3 -c "from urllib.parse import urlparse; print(urlparse('http://example.com/path%0d%0aInjection:test'))" and check if CR/LF characters appear in parsed componentsCheck Version:
python --version or python3 --versionVerify Fix Applied:
After patching, same test should show CR/LF characters removed or properly handled in parsed output📡 Detection & Monitoring
Log Indicators:
- URLs containing %0d, %0a, \r, or \n in path components
- Unusual HTTP headers or response splitting in web server logs
Network Indicators:
- HTTP requests with encoded CR/LF characters in URLs
- Abnormal HTTP responses with injected headers
SIEM Query:
source="web_logs" AND (url="*%0d*" OR url="*%0a*" OR url="*\\r*" OR url="*\\n*")🔗 References
- https://bugs.python.org/issue43882
- https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CSD2YBXP3ZF44E44QMIIAR5VTO35KTRB/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDBDBAU6HUPZHISBOARTXZ5GKHF2VH5U/
- https://security.gentoo.org/glsa/202305-02
- https://security.netapp.com/advisory/ntap-20220225-0009/
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://bugs.python.org/issue43882
- https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html
- https://lists.debian.org/debian-lts-announce/2024/11/msg00024.html
- https://lists.debian.org/debian-lts-announce/2025/03/msg00013.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CSD2YBXP3ZF44E44QMIIAR5VTO35KTRB/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDBDBAU6HUPZHISBOARTXZ5GKHF2VH5U/
- https://security.gentoo.org/glsa/202305-02
- https://security.netapp.com/advisory/ntap-20220225-0009/
- https://www.oracle.com/security-alerts/cpuapr2022.html
